Open
Conversation
![bridgecrew-staging[bot]](https://avatars.githubusercontent.com/in/114134?s=60&v=4){kind=small}
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure the S3 bucket has access logging enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_13
How to Fix
resource "aws_s3_bucket" "bucket" {
acl = var.s3_bucket_acl
bucket = var.s3_bucket_name
policy = var.s3_bucket_policy
force_destroy = var.s3_bucket_force_destroy
versioning {
enabled = var.versioning
mfa_delete = var.mfa_delete
}
+ dynamic "logging" {
+ for_each = var.logging
+ content {
+ target_bucket = logging.value["target_bucket"]
+ target_prefix = "log/${var.s3_bucket_name}"
+ }
+ }
}Description
Access logging provides detailed audit logging for all objects and folders in an S3 bucket.Benchmarks
- HIPAA 164.312(B) Audit controls
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has block public ACLS enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_19
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
+ block_public_acls = true
block_public_policy = true
restrict_public_buckets = true
ignore_public_acls=true
}Description
Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.
We recommend you set S3 Bucket BlockPublicAcls to True.
Benchmarks
- CIS AWS V1.3 1.20
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has block public policy enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_20
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
block_public_acls = true
+ block_public_policy = true
restrict_public_buckets = true
ignore_public_acls=true
}Description
Amazon S3 Block Public Access policy works at the account level and on individual buckets, including those created in the future. It provides the ability to block existing public access, whether specified by an ACL or a policy, and ensures public access is not granted to newly created items.If an AWS account is used to host a data lake or another business application, blocking public access will serve as an account-level guard against accidental public exposure.
Benchmarks
- FEDRAMP (MODERATE) SC-7(3), SC-7, AC-21(b), AC-6, AC-4, AC-3
- PCI-DSS V3.2.1 2.2, 1.3
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has ignore public ACLs enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_21
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
block_public_acls = true
block_public_policy = true
restrict_public_buckets = true
+ ignore_public_acls=true
}Description
The IgnorePublicAcls setting causes S3 to ignore all public ACLs on a bucket and any objects that it contains. Enabling this setting does not affect the persistence of any existing ACLs and does not prevent new public ACLs from being set.This setting will block public access granted by ACLs while still allowing PUT Object calls that include a public ACL.
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has 'restrict_public_bucket' enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_22
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
block_public_acls = true
block_public_policy = true
+ restrict_public_buckets = true
ignore_public_acls=true
}Description
The S3 Block Public Access configuration enables specifying whether S3 should restrict public bucket policies for buckets in this account. Setting RestrictPublicBucket to TRUE restricts access to buckets with public policies to only AWS services and authorized users within this account.Enabling this setting does not affect previously stored bucket policies. Public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure the S3 bucket has access logging enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_13
How to Fix
resource "aws_s3_bucket" "bucket" {
acl = var.s3_bucket_acl
bucket = var.s3_bucket_name
policy = var.s3_bucket_policy
force_destroy = var.s3_bucket_force_destroy
versioning {
enabled = var.versioning
mfa_delete = var.mfa_delete
}
+ dynamic "logging" {
+ for_each = var.logging
+ content {
+ target_bucket = logging.value["target_bucket"]
+ target_prefix = "log/${var.s3_bucket_name}"
+ }
+ }
}Description
Access logging provides detailed audit logging for all objects and folders in an S3 bucket.Benchmarks
- HIPAA 164.312(B) Audit controls
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has block public ACLS enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_19
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
+ block_public_acls = true
block_public_policy = true
restrict_public_buckets = true
ignore_public_acls=true
}Description
Amazon S3 buckets and objects are configured to be private. They are protected by default, with the option to use Access Control Lists (ACLs) and bucket policies to grant access to other AWS accounts and to anonymous public requests. The **Block public access to buckets and objects granted through new access control lists (ACLs)** option does not allow the use of new public bucket or object ACLs, ensuring future PUT requests that include them will fail.This setting helps protect against future attempts to use ACLs to make buckets or objects public. When an application tries to upload an object with a public ACL this setting will be blocked for public access.
We recommend you set S3 Bucket BlockPublicAcls to True.
Benchmarks
- CIS AWS V1.3 1.20
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has block public policy enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_20
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
block_public_acls = true
+ block_public_policy = true
restrict_public_buckets = true
ignore_public_acls=true
}Description
Amazon S3 Block Public Access policy works at the account level and on individual buckets, including those created in the future. It provides the ability to block existing public access, whether specified by an ACL or a policy, and ensures public access is not granted to newly created items.If an AWS account is used to host a data lake or another business application, blocking public access will serve as an account-level guard against accidental public exposure.
Benchmarks
- FEDRAMP (MODERATE) SC-7(3), SC-7, AC-21(b), AC-6, AC-4, AC-3
- PCI-DSS V3.2.1 2.2, 1.3
| Tags: | ||
| - Key: Name | ||
| Value: !Sub "${AWS::AccountId}-${CompanyName}-${Environment}-logs" | ||
|
|
There was a problem hiding this comment.
Ensure S3 bucket has 'restrict_public_bucket' enabled
Resource: AWS::S3::Bucket.LogsBucket | ID: BC_AWS_S3_22
How to Fix
resource "aws_s3_bucket_public_access_block" "artifacts" {
count = var.bucketname == "" ? 1 : 0
bucket = aws_s3_bucket.artifacts[0].id
block_public_acls = true
block_public_policy = true
+ restrict_public_buckets = true
ignore_public_acls=true
}Description
The S3 Block Public Access configuration enables specifying whether S3 should restrict public bucket policies for buckets in this account. Setting RestrictPublicBucket to TRUE restricts access to buckets with public policies to only AWS services and authorized users within this account.Enabling this setting does not affect previously stored bucket policies. Public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.